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For: ANTI-VIRUS PROTECTION AT A NETWORK GATEWAY 

PRE-APPEAL BRIEF REQUEST FOR REVIEW 

MAIL STOP: AF 

Commissioner for Patents 
P.O. Box 1450 

Alexandria, Virginia 22313-1450 Date: August 19, 2008 

Sir: 

Applicant requests review of the Final Office Action mailed April 23, 2008, the 
period for response being extended one month from July 23, 2008 to August 23, 2008 
with payment of the appropriate fees. No amendment is being made to the claims 
currently pending. Claims 1-4 and 6-8 are pending. The Office Action is the third and 
Final Office Action in this application. Thus, this application qualifies for Appeal. 

The Office Action rejects claims 1-4 and 6-8 under 35 U.S.C. § 103(a) as being 
unpatentable over Tarbotton et al. (U.S. Patent No. 6,757,830) in view of Shipp (U.S. 
Patent Application Publication No. 2004/0054498). The Applicant submits that the 
rejection is made in error for at least the reasons set forth below. 
I. The Office Action has not Established a Prima Facie Case of Obviousness 

A. Claims 1-4 
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The Applicant respectfully submits that the applied references taken alone or in 
combination fail to disclose or suggest a method of preventing the infection of a 
computer network by a computer virus, where that virus can spread by e-mail traffic, the 
method including at least the following features "in the event that a new virus is detected 
by a provider of the anti-virus application, sending a notification of this event from the 
provider to the anti-virus application, at the anti-virus application, responding to said 
notification by discontinuing normal handling of e-mails, wherein discontinuing normal 
handling of e-mails includes failing to deliver incoming e-mails or their attachments to 
their recipients within the network and causing these e-mails or attachments to be re- 
directed to a buffer for safe storage; subsequently generating a signature for the virus at 
the anti-virus application provider and providing that signature to the application at the 
gateway; at the gateway, after receiving the signature, using the application to scan the 
previously buffered e-mails or attachments for the virus, after scanning the buffered e- 
mails, delivering e-mails or attachments which are virus free to their recipients; and 
causing the normal handling of e-mails at the e-mail gateway to be resumed," as recited 
in claim 1. 

Although Tarbotton notes that it takes time to react to and generate counter- 
measures against a new virus, Tarbotton responds by delaying the delivery of e-mails at 
all times. The delay is determined solely by the risk characteristics of the e-mails and 
not upon a notification from a provider of anti-virus application. (See column 6, lines 59- 
67). This delay provides an opportunity for an anti-virus server to update virus 
signatures to the gateway and increase the chances of identifying infected e-mails. 
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Thus, e-mails are buffered at the gateway to allow virus alerts to catch up with e-mail 

delivery. 

Shipp fails to cure the deficiency in Tarbotton. Ship teaches a method of 
detecting the spread of a previously unknown virus by monitoring patterns of e-mail 
traffic. Once a suspected virus is detected, the characteristics of infected e-mails are 
provided to the e-mail gateways. Shipp merely provides an allegedly improved virus 
"fingerprint." Therefore, Shipp discloses the provision of conventional anti-virus updates 
rather than advance notification as provided in claim 1. 

Thus, the combination of Tarbotton and Shipp would result in the improvement of 
receiving virus updates not the provision of advance notification updates. E-mails would 
continue to be buffered at the e-mail gateway for a predetermined time to allow virus 
alerts to catch up with e-mail delay instead of initiating the buffering of e-mail based 
upon a notification of a new virus. 

The Office Action notes that Tarbotton does not disclose or suggest discontinuing 
the normal handling of e-mails when notified of a new virus and subsequently resuming 
the normal handling of e-mails when appropriate countermeasures have been taken, 
but asserts that this would have been obvious. 

As Tarbotton functions by delaying all e-mail where the length of time depends 
on the individual characteristics of each e-mail, the Office Action's proposed 
modification that "wherein discontinuing normal handling of e-mails includes failing to 
deliver incoming e-mails or their attachments and causing these e-mails to be re- 
directed to a buffer for safe storage" as recited in claim 1 would improperly change the 
principle of operation in Tarbotton. See MPEP § 2143.01. 
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For at least this combination of reasons, the Applicant submits that claim 1 is 
allowable over the cited art. As claim 1 is allowable, the Applicant submits that claims 
2-4, which depend from allowable claim 1 , are therefore also allowable for at least the 
above noted reasons and for the additional subject matter recited therein. 
B. Claims 6, 7 and 8 

The inventions recited in claims 6 and 7 involve a first notification sent by the 
provider that diverts the flow of e-mail to a buffer and a second notification that causes 
the gateway to cease preventing delivery of newly received e-mails. 

As discussed above, Tarbotton always delays newly received e-mails and Shipp 
fails to cure the deficiency in Tarbotton. Thus, for reasons similar to those discussed 
above, the Applicant submits that claims 6 and 7 are allowable over the cited art. 

Applicant's invention as set forth in claim 8 is directed to a method of preventing 
the infection of a computer network by a computer virus, the method comprising in the 
event that a new virus is detected by the provider of the anti-virus application, 
calculating a checksum for the file carrying the virus or a relevant part of that file, and 
sending a notification containing the checksum from the provider to the anti-virus 
application, and at the anti-virus application, using the checksum to screen e-mails 
and/or their attachments for the virus until such time as a signature for the virus is 
received by the e-mail gateway from the application provider. 

Tarbotton teaches an e-mail message including a header portion including a 
checksum value for the e-mail message as a whole as a countermeasure against 
attempts to falsely insert data indicating that a minimum delay period has already been 
applied to the message. 
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Tarbotton does not disclose or suggest using a checksum to screen e-mails for a 
virus, as recited in claim 8. Additionally, Tarbotton does not teach a checksum provided 
by the anti-virus application provider as part of a new virus notification, as recited in 
claim 8. Furthermore, Tarbotton does not disclose or suggest replacing the use of the 
checksum from the anti-virus application provider until such time as a signature for the 
virus is received. As discussed above, Shipp fails to cure the deficiency in Tarbotton. 

For at least this combination of reasons, the Applicant submits that claim 8 is 
allowable over the cited art. 
II. Conclusion 

For all of the above reasons, a pre-Appeal Brief review of the outstanding 
Office Action is respectfully requested, and a favorable decision including allowance of 
all pending claims is earnestly solicited. In the event this paper is not considered to be 
timely filed, the Applicant respectfully petitions for an appropriate extension of time. Any 
fees for such an extension, together with any additional fees that may be due with 
respect to this paper, may be charged to counsel's Deposit Account No. 01-2300, 
referencing Attorney Dkt No. 108347-00031. 
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